http: guard against response splitting in trailers
Commit 3c293ba2 ("http: protect against response splitting attacks") filters out newline characters from HTTP headers but forgot to apply the same logic to trailing HTTP headers, i.e., headers that come after the response body. This commit rectifies that.
The expected security impact is low because approximately no one uses trailing headers. Some HTTP clients can't even parse them.
R=@ChALkeR